Before You Install 25 Agent Skills, Check These 7 Permission Risks
Snyk scanned 3,984 agent skills and found security issues in 36.82%, with 13.4% containing critical vulnerabilities and 76 confirmed malicious payloads; a separate study of 31,132 skills found vulnerabilities in 26.1% Agent skills are packages, not prompts — they can contain shell scripts, Python code, external URLs, and permission instructions that go far beyond their marketplace descriptions Seven key permission risks identified: broad shell access, sensitive reads combined with network access
Analysis
TL;DR
- Snyk scanned 3,984 agent skills and found security issues in 36.82%, with 13.4% containing critical vulnerabilities and 76 confirmed malicious payloads; a separate study of 31,132 skills found vulnerabilities in 26.1%
- Agent skills are packages, not prompts — they can contain shell scripts, Python code, external URLs, and permission instructions that go far beyond their marketplace descriptions
- Seven key permission risks identified: broad shell access, sensitive reads combined with network access, mutable remote setup, hidden executable paths, permission bypass modes, hardcoded secrets, and unpinned/lookalike sources
- Skills with scripts are 2.12 times more likely to contain vulnerabilities than instruction-only skills, making superficial Markdown reviews insufficient
- A layered security approach is essential: trusted sources, human review, least privilege, deny rules, and sandboxed execution environments
Why It Matters
As AI agents become more widely deployed in enterprise environments, the agent skill ecosystem represents a growing attack surface that security teams are only beginning to understand. The gap between how skills are marketed (friendly descriptions) and what they actually do (execute arbitrary code, access secrets, exfiltrate data) creates a trust transfer problem that most organizations are not equipped to handle. This is particularly urgent as marketplaces like ClawHub and skills.sh lower the barrier to installing third-party agent capabilities.
Technical Details
- Empirical findings: Snyk's "ToxicSkills" report analyzed 3,984 skills from ClawHub and skills.sh, identifying 36.82% with at least one security issue and 13.4% with critical vulnerabilities. Liu et al.'s study of 31,132 skills found 26.1% contained vulnerabilities, with script-containing skills showing 2.12x higher vulnerability likelihood
- Skill architecture: Anthropic defines skills as directories containing a required SKILL.md and optional scripts, resources, and tool configurations. Progressive loading means the initial description may not reveal the full capability set, as additional content loads after the context window
- Permission model: Claude Code evaluates permissions in deny/ask/allow order, with deny rules taking precedence. However, deny rules only control built-in tools — shell processes can bypass Read denials using commands like
cat - Attack patterns: Common malicious patterns include
curl | bashpipelines, unpinned remote installs, hardcoded credentials, references to sensitive paths (~/.ssh, ~/.aws, .env), and outbound HTTP calls combined with file reads - Mitigation framework: Anthropic's enterprise guidance recommends inspecting every file in a skill directory, verifying scripts match stated purpose, checking for external URLs, identifying tools, auditing credentials, and hunting exfiltration paths
Industry Insight
- Organizations should treat skill installation as a trust transfer event requiring the same rigor as dependency management in traditional software supply chains — pin versions, review commits, and audit upgrades, not just approve marketplace one-click installs
- The "seven-minute audit" framework (confirm source, list full tree, search for execution/data paths/egress, compare capability to purpose) should become a mandatory gate before skills enter production environments, especially given that 1 in 3 skills currently contains at least one issue
- Deny rules and permission policies alone are insufficient; teams must combine them with filesystem/network sandboxes, since command-pattern filtering is fragile and shell access can circumvent tool-level restrictions — the safest posture requires layered defense with untrusted execution isolated in disposable containers
Disclaimer: The above content is generated by AI and is for reference only.